nmap / npcap

Nmap Project's Windows packet capture and transmission library
https://npcap.com
Other
2.91k stars 509 forks source link

Update Npcap to support NDIS 6.89 #737

Open anrossi opened 1 month ago

anrossi commented 1 month ago

This is a feature request is to update NpCap so the MajorNdisVersion and MinorNdisVersion in NDIS_FILTER_DRIVER_CHARACTERISTICS passed to NdisFRegisterFilterDriver are updated to NDIS 6.89.

NDIS 6.89 adds support for a new hardware offload, UDP RSC Offload (URO). To ensure that existing and legacy NDIS Lightweight Filters (LWFs) are not broken by receiving large coalesced UDP packets, NDIS will disable URO on the NIC when an LWF or NDIS protocol driver binds to the stack, that targets a lower NDIS version.

Currently, this means that Windows 11 systems with a NIC that supports URO, that install npcap, will see URO disabled until npcap is uninstalled.

If NpCap already handles TCP Receive Segment Coalescing (RSC), then supporting URO should be very little work.

fyodor commented 3 weeks ago

Thanks for the suggestion, @anrossi. Deciding which NDIS versions to support is tricky since we need to create a different driver for each platform for each release for each NDIS version we support. Npcap 1.79 includes the following drivers:

x64 platform: We have the following three drivers:

x86 (32-bit) platform: We have three drivers supporting the same NDIS versions as on x64. Microsoft doesn't support this platform on Windows 11 or Windows Server 2012 and later, so we don't expect to expand this set of drivers.

ARM: We currently just have one driver (NDIS 6.50) for this since it's a much newer platfrom.

Microsoft has some useful details on their Overview of NDIS versions page.

With the NDIS improvements made since 6.50, it probably is about time that we split off a newer driver for x64 and ARM to support the latest features. Is NDIS 6.89 supported on mainstream Windows releases already or are you using a preview release?

We probably can't get this into the upcoming Npcap 1.80 release, but hopefully the next one!

anrossi commented 3 weeks ago

Hi @fyodor, Thanks for the explanation of how Npcap handles NDIS versions. Given the broad range of OSes supported by Npcap, I was wondering how it did it all. NDIS 6.89 is stated to ship with Windows 11 24H2 (at the link you shared), when that goes out of preview. I agree that this support only needs to be added to the x64 and ARM drivers, since those are the platforms Microsoft continues to support for the foreseeable future. I appreciate you looking at this and getting it scheduled for the release after 1.80. What kind of timeline does that leave until then?